Re: Security updates and packages

2016-08-19 Thread Ingo Schwarze
Hi, on a lighter note, 'cause i usually (with exceptions :) like doing what i like to do better than arguing with people who happen to misunderstand it... Theo de Raadt screamed on Fri, Aug 19, 2016 at 08:25:40AM -0600: > AND WHERE IS THE PONY. Right here: https://plus.google.com/collection/

Re: Security updates and packages

2016-08-19 Thread Mihai Popescu
> OK I have done a lot of cutting and I may have put your words out of context, > this isn't intended of course, however I feel when you say "OpenBSD isn't a > PRODUCT" that this just can't be. By that I mean, that I buy every CD that > comes out, a) it has an ISBN number so it's a book (but not r

Re: Security updates and packages

2016-08-19 Thread Theo de Raadt
> > You never purchased an agreement for it to be serviced. > > I'm not expecting that. But the "hint" that this will not be serviced > should be there. The lack of a promise is enough. > > Then, you stand here and demand things? You sir, are just wastewater. > > I simply suggested a line to

Re: Security updates and packages

2016-08-19 Thread Theo de Raadt
> Not "purely" but in common parlance and practice I do regard prompt > installation of fixes for "security flaws" as part of "security" in its > usual sense, yes. Then hire some people to do it. Our crew who cares about a subset of that is at their limit. We aren't going to keep slaves, and gar

Re: Security updates and packages

2016-08-19 Thread Mark Carroll
On 19 Aug 2016, Theo de Raadt wrote: (snip) > There is no juxtaposition. I'm pretty sure that I managed to place the quotations side by side! > You are expecting a bunch of volunteers to do the massive job of > upgrading last-month's software -- and do it better than Google with > Android, or car

Re: Security updates and packages

2016-08-19 Thread Peter J. Philipp
On 08/19/16 17:43, Theo de Raadt wrote: >>> You even come to the conclusion that such work isn't going to happen >>> for free, but leave the result dangling. Especially since OpenBSD >>> isn't a PRODUCT. If product-servicing is a requirement, first of all >>> choose something which is a PRODUCT,

Re: Security updates and packages

2016-08-19 Thread Theo de Raadt
> > You even come to the conclusion that such work isn't going to happen > > for free, but leave the result dangling. Especially since OpenBSD > > isn't a PRODUCT. If product-servicing is a requirement, first of all > > choose something which is a PRODUCT, then choose a PRODUCT VENDOR who > > act

Re: Security updates and packages

2016-08-19 Thread Peter J. Philipp
> You even come to the conclusion that such work isn't going to happen > for free, but leave the result dangling. Especially since OpenBSD > isn't a PRODUCT. If product-servicing is a requirement, first of all > choose something which is a PRODUCT, then choose a PRODUCT VENDOR who > actually does

Re: Security updates and packages

2016-08-19 Thread Jack J. Woehr
Theo de Raadt wrote: Especially since OpenBSD isn't a PRODUCT. If product-servicing is a requirement, first of all choose something which is a PRODUCT, then choose a PRODUCT VENDOR who actually does SERVICING. Nicely put. My open source Ublu (https://github.com/jwoehr/ublu) is currently att

Re: Security updates and packages

2016-08-19 Thread Theo de Raadt
> > I was wondering if packages for -release would be fixed if a security > > issue is found in one of these third party programs, which could be > > updated with pkg_add -u. > > It's a good question. I was quite amused to notice the juxtaposition of: > > ] Our aspiration is to be NUMBER ONE in t

Re: Security updates and packages

2016-08-19 Thread Stuart Henderson
On 2016-08-19, Thuban wrote: > I was wondering if packages for -release would be fixed if a security > issue is found in one of these third party programs, which could be > updated with pkg_add -u. No, they're not, they're fixed for release and not further updated. It's the same for the base OS -

Re: Security updates and packages

2016-08-19 Thread Philipp Westphal
Hi, haveva look at this: https://stable.mtier.org/ Regards Am 19.08.2016 08:59 schrieb "Thuban" : > Hello, > I was wondering if packages for -release would be fixed if a security > issue is found in one of these third party programs, which could be > updated with pkg_add -u. > > Or does someon

Re: Security updates and packages

2016-08-19 Thread Christer Solskogen
On Fri, Aug 19, 2016 at 8:58 AM, Thuban wrote: > Hello, > I was wondering if packages for -release would be fixed if a security > issue is found in one of these third party programs, which could be > updated with pkg_add -u. > Officially? No. But this seems to be a "industry standard" - https://s

Re: Security updates and packages

2016-08-19 Thread Janne Johansson
You can pay someone to build them for you, where M:Tier springs to mind. Also, having a build host (or vm) somewhere running -stable and (re)building any updated -stable port for your particular platform isn't all that difficult and hard, especially if its just about a single or a specific small s

Re: Security updates and packages

2016-08-19 Thread Mark Carroll
On 19 Aug 2016, thu...@yeuxdelibad.net wrote: > I was wondering if packages for -release would be fixed if a security > issue is found in one of these third party programs, which could be > updated with pkg_add -u. It's a good question. I was quite amused to notice the juxtaposition of: ] Our as

Security updates and packages

2016-08-18 Thread Thuban
Hello, I was wondering if packages for -release would be fixed if a security issue is found in one of these third party programs, which could be updated with pkg_add -u. Or does someone has to stay up to date and usr ports to upgrade each single package on his system to follow -stable? (with the r